Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699309 source statements · aliases may refer to the same vulnerability

GO-2026-6453Published

Unbounded memory allocation via streaming row reader in github.com/xuri/excelize

osv · CVE-2026-59161 · GHSA-q5j5-6p94-4gwc

Go: github.com/xuri/excelize/v2

Source modified 17 Sep 2026Recorded 24 Oct 2026

GHSA-mggc-4xg6-vcxfPublished

SSH.NET: ScpClient allows server-side RCE via default SCP path handling

osv · CVE-2026-85756

NuGet: SSH.NET

HIGHSource modified 17 Sep 2026Recorded 23 Oct 2026

MAL-2026-16151Published

Malicious code in sql-limit-enforcer (npm)

osv ·

npm: sql-limit-enforcer

Source modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-20290Published

Cisco Secure Firewall Threat Defense Software Snort 2 SSL/TLS Denial of Service Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Threat Defense (FTD) Software

CVSS 3.1 5.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86038Published

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

cve-program ·

Vendor product: js-libp2p

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-75523Published

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

cve-program ·

Vendor product: security-advisories

CVSS 3.1 5.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-69197Published

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

cve-program ·

Vendor product: Umbraco-CMS

CVSS 4.0 8.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-85721Published

AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service

cve-program ·

Vendor product: async-http-client

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-54585Published

mport sample file handling can write outside the configured root

cve-program ·

Vendor product: mport

CVSS 4.0 6.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-56395Rejected

Rejected reason: This record is a duplicate; use CVE-2026-56397 instead.

nvd ·

Source modified 17 Sep 2026Recorded 25 Oct 2026

GHSA-vqrw-qphh-p34vPublished

TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

osv · CVE-2026-54546

npm: @tak-ps/cloudtak

MODERATESource modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-12793Published

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

cve-program ·

Vendor product: JetFormBuilder — Dynamic Blocks Form Builder

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92217Published

a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

cve-program ·

Vendor product: a2ui

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2025-56563Published

A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation…

cve-program ·

Vendor product: n/a

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-51990Published

An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component

cve-program ·

Vendor product: n/a

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-54583Published

mport package bundle downloads allow unsafe destination filenames

cve-program ·

Vendor product: mport

CVSS 4.0 8.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92184Published

ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery

cve-program ·

Vendor product: ag-ui

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76872Published

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages

cve-program ·

Vendor product: NR255-V

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76867Published

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers

cve-program ·

Vendor product: NR255-V

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76862Published

Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths

cve-program ·

Vendor product: NR255-V

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76857Published

Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi

cve-program ·

Vendor product: NR255-V

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76852Published

Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write

cve-program ·

Vendor product: NR268

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-61559Published

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

cve-program ·

Vendor product: gitlab-mcp

CVSS 3.1 9.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-89027Published

miniOrange JWT Authentication for WP REST APIs < 4.8.0 Authentication Downgrade

cve-program ·

Vendor product: JWT Authentication for WP REST APIs

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-61544Published

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

cve-program ·

Vendor product: rust-libp2p

CVSS 4.0 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-69218Published

Http4s Ember HTTP/2: unbounded continuation frame accumulation

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-69210Published

Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

GHSA-wr57-hqmp-fgvhPublished

Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion

osv · CVE-2026-69197

NuGet: Umbraco.Cms · NuGet: Umbraco.Cms · NuGet: Umbraco.Cms

HIGHSource modified 17 Sep 2026Recorded 23 Oct 2026

GHSA-9g45-5xwm-f3wcPublished

RMCP: Custom HTTP headers leak to cross-origin redirect targets

osv · CVE-2026-64684

crates.io: rmcp

MODERATESource modified 17 Sep 2026Recorded 24 Oct 2026

GHSA-pj96-35fp-cfccPublished

ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

osv · CVE-2026-85715

npm: exifreader

HIGHSource modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-69213Published

Http4s Ember HTTP/2: unbounded outbound frame queue

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2023-53159Published

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.5 · CVSS 3.1 · [email protected] · Primary 3.3Source modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-69208Published

Http4s: DigestAuth nonce map grows unbounded

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81237Published

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

cve-program ·

Vendor product: Wyse Management Suite

CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-85718Published

AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of service

cve-program ·

Vendor product: async-http-client

CVSS 3.1 5.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-54689Published

mcp-searxng hardened-mode SSRF bypasses permit internal URL access

cve-program ·

Vendor product: mcp-searxng

CVSS 3.1 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-58502Published

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

cve-program ·

Vendor product: githubtoplanguages

CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-61668Published

DIRAC: Pilot code downloaded over unverified HTTPS connection

cve-program ·

Vendor product: DIRAC

CVSS 3.1 8.1Source modified 17 Sep 2026Recorded 23 Oct 2026

GHSA-g74q-6g2f-874xPublished

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

osv · CVE-2026-63506

npm: @tinacms/auth · npm: next-tinacms-azure

HIGHSource modified 17 Sep 2026Recorded 24 Oct 2026

GHSA-657c-g7qc-r9j2Published

Redocly CLI: Path traversal when using `split` command

osv · CVE-2026-63225

npm: @redocly/cli · npm: @redocly/cli

MODERATESource modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-11921Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 17 Sep 2026Recorded 23 Oct 2026

MAL-2026-16260Published

Malicious code in confx1789550882 (npm)

osv ·

npm: confx1789550882

Source modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-53459Published

Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

cve-program ·

Vendor product: bambuddy

CVSS 4.0 9.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-11928Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-54547Published

Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

cve-program ·

Vendor product: meta-ads-mcp

CVSS 3.1 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-12150Published

IBM MQ queue manager is vulnerable to denial of service

cve-program ·

Vendor product: MQ

CVSS 3.1 7.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-12666Published

IBM MQ Java messaging is vulnerable to XML external entity injection

cve-program ·

Vendor product: MQ

CVSS 3.1 8.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-12750Published

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

cve-program ·

Vendor product: Cloud Pak for Business Automation

CVSS 3.1 6.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79419Published

A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Im…

cve-program ·

Vendor product: n/a

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-44778Published

Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF

cve-program ·

Vendor product: inspektor-gadget

CVSS 4.0 2.9Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.